Imagine waking up one morning to discover that your name, home address, and national identification number may now be in the hands of criminals.
You didn’t click a suspicious link. You didn’t share your password. You didn’t make a mistake.
Someone else had access to a system containing your personal information, and that access was abused.
Now imagine learning that a compromised account was only the beginning of the failure.
In one incident, the university later documented vulnerabilities and privilege escalation in its identity-management system.
Two Danish incidents disclosed in October 2026 show why authentication, authorization and monitoring need to work together.
And while the scale of these incidents is alarming, the underlying security lesson is hardly new.
More than twenty years ago, an American company called ChoicePoint experienced a remarkably similar failure. In 2023, the MGM Resorts cyberattack provided another reminder of the consequences when identity and access protections are undermined.
Different organizations. Different technologies. Different circumstances.
But a common question emerges:
What happens when our security systems focus on allowing someone in, without sufficiently controlling what they can do once they’re inside?
For years, the cybersecurity industry has devoted enormous resources to answering one essential question:
Who are you?
It’s an important question.
But it is only half the conversation.
The other half may be even more consequential:
What are you authorized to do?
Because one AUTH is not enough.
Authentication establishes control of an enrolled account or authenticator. Authorization determines which resources and actions that account may use. Neither a successful login nor a human approval replaces application permissions, least privilege or monitoring.
The Breach That Didn’t Require Breaking In
ChoicePoint, a major American data broker, maintained extensive collections of personal information, including Social Security numbers, dates of birth and credit-related records.
Thousands of businesses relied on ChoicePoint to verify information about customers and other individuals.
Criminals discovered that they didn’t necessarily need to break into ChoicePoint’s computer systems to obtain that information.
Instead, they posed as legitimate businesses and applied for customer accounts.
ChoicePoint approved fraudulent applications, granting the criminals access to personal records through its normal commercial processes.
According to the Federal Trade Commission, the incident exposed information relating to at least 163,000 people.
The company had mechanisms for providing information to authorized customers.
But its customer-verification procedures failed to adequately distinguish legitimate businesses from fraudulent applicants.
The result was devastatingly simple.
The criminals obtained access by convincing the organization that they deserved it.
And once that access was granted, sensitive information became available to them.
ChoicePoint reminds us that security failures don’t always begin with sophisticated hacking.
Sometimes they begin with misplaced trust.
Denmark: Twenty Years Later, a Familiar Problem
DTU publicly disclosed its attack on October 2, 2026. Its later timeline describes compromised accounts, exploited vulnerabilities and elevated privileges in DTUBasen.
DTU detected unexpected changes on September 20. It could not establish the full extent of the leak.
DTU therefore treated data on approximately 200,000 active and inactive users as potentially exposed.
A separate CPR incident became known to the register administration on October 2 and was publicly described by the ministry on October 5.
CPR records include living residents, people who have moved abroad and people who have died.
The ministry said a private Danish company’s legitimate query access had been misused to obtain information on approximately 8.8 million registered people.
The ministry said it stopped the company’s access and referred the incident to the relevant authorities.
Consider what that means.
Legitimate query access had become a route to personal information at an extraordinary scale.
The official statement does not establish the exact credential-compromise or detection mechanism.
The account had a legitimate business purpose.
But the activity conducted through it went far beyond that purpose.
The incident shows why a recognized account is not enough to establish that every use of its access is appropriate.
The public sources do not establish that stronger authentication alone would have prevented either incident, or precisely which authorization and monitoring controls were deployed in the CPR case.
The design lesson is to constrain sensitive queries by purpose, scope and volume, and to detect misuse. That is an architectural inference, not a finding about every missing control in either system.
And that brings us to the distinction at the center of this article.
One AUTH Is Not Enough
Authentication and authorization are often discussed together, but they perform fundamentally different functions.
Authentication asks: Who are you?
Authorization asks: What are you permitted to do?
Authentication helps establish whether an individual, device, application, or machine is who or what it claims to be.
Authorization determines which resources that identity may access and which actions it may perform.
Neither is sufficient on its own.
An employee might be authorized to access a particular customer record.
That doesn’t mean the employee should be able to download the entire customer database.
A physician may need access to a patient’s medical history.
That doesn’t justify unrestricted access to every patient’s records.
A financial employee may have authority to initiate a payment.
That doesn’t necessarily mean the employee can approve an unlimited transfer without additional controls.
And a business with permission to verify individual records should not automatically possess the ability to retrieve millions of identities.
Gaining access is not the same as deserving unlimited access.
Even strong authentication cannot independently determine whether every subsequent action is appropriate.
That requires effective authorization.
And authorization must be enforced, not merely documented in a policy.
For sensitive registers, purpose-limited access, query limits, monitoring and containment are complementary design controls. Their effectiveness depends on the implementation and threat model.
These measures are distinct from authentication, but they must work alongside it.
The objective is not to make every legitimate action more difficult.
It is to ensure that legitimate access remains consistent with legitimate authority.
Authentication Opens the Gate. Authorization Protects the Kingdom.
Years ago, when developing an educational presentation around King Arthur and the security of his kingdom, we used a simple analogy to explain a distinction that even experienced executives sometimes overlook.
Authentication Opens the Gate. Authorization Protects the Kingdom.
Imagine a medieval castle.
At the entrance, a guard verifies the identity of someone requesting entry.
The individual is recognized and permitted through the gate.
But what happens next?
Does entering the castle automatically grant that person permission to enter the royal treasury?
The king’s private chambers?
The armory?
The room containing the kingdom’s most sensitive military plans?
Of course not.
The guard at the gate has established who the visitor is.
That doesn’t establish what the visitor is entitled to do.
The kingdom still needs rules governing which rooms may be entered, which resources may be accessed, and which actions require additional approval.
And those rules must remain enforceable after the visitor enters.
The analogy may be centuries old, but the security lesson couldn’t be more contemporary.
A successfully authenticated user should not automatically inherit unrestricted authority throughout an organization’s digital environment.
Yet security architectures sometimes place enormous emphasis on the front gate while paying insufficient attention to what happens beyond it.
We celebrate successful authentication.
We measure login security.
We deploy increasingly sophisticated identity technologies.
All important investments.
But if access permissions are excessive, sensitive transactions lack appropriate approval, or suspicious activity continues unchecked, the kingdom remains vulnerable.
A stronger gate cannot compensate for an unprotected treasury.
The castle needs both.
So does the modern enterprise.
MGM Resorts: When Identity Processes Become the Weak Link
The 2023 MGM Resorts cyberattack demonstrated another dimension of this problem.
MGM’s own disclosure confirms a cybersecurity incident and disruption to its operations. It does not by itself establish the complete initial-access chain.
We should distinguish that confirmed record from reports attributing the initial access to social engineering.
The consequences were substantial, disrupting hotel and casino operations and creating significant financial and operational impacts.
The MGM incident highlights why identity verification and account recovery procedures must be treated as critical security controls.
But it also raises an equally important architectural question.
Once an account or identity process has been compromised, how much damage can the attacker do?
Which systems can that identity reach?
What privileges can it exercise?
Can those privileges be restricted?
Can suspicious activity be detected and contained before the consequences spread?
It would be inaccurate to conclude from the public reporting that MGM simply had no authorization controls. The incident involved multiple security and operational factors.
Nevertheless, the broader lesson is clear.
Strong identity verification helps prevent unauthorized entry. Effective authorization and least-privilege access help limit what happens if that entry occurs.
And continuous monitoring helps organizations recognize when activity no longer deserves their trust.
Authentication, authorization, and continuous evaluation are not competing approaches.
They are complementary defenses.
Remove any one of them, and the entire architecture becomes less dependable.
When Knowing Your Identity Number Is Mistaken for Being You
The Danish incidents also expose another longstanding weakness in digital identity.
Denmark’s Central Person Register assigns individuals a ten-digit CPR number used throughout public services, healthcare, banking, and other essential activities.
Such identifiers are valuable for administrative purposes.
But an identifier should not be confused with an authenticator.
A name identifies someone.
An address helps distinguish one person from another.
A national identification number may help locate a particular record.
None of these facts, individually or collectively, necessarily proves that the person presenting them is the rightful owner of the identity.
Yet organizations sometimes rely on precisely this information to establish confidence in a caller, customer, or applicant.
Once personal information becomes widely available, criminals can use it to make impersonation attempts more convincing.
A caller who knows your name, address, date of birth, and national identification number may sound legitimate.
But familiarity with personal information is not proof of identity.
A convincing identity is not necessarily a verified identity.
Fortunately, stronger digital identity systems can help reduce this risk.
The CPR exposure does not by itself establish a compromise of a separate authentication service such as MitID.
But the broader lesson applies globally.
Organizations must stop treating information about a person as sufficient evidence that the person is actually present or has authorized an action.
This distinction becomes even more consequential as artificial intelligence makes impersonation increasingly convincing.
Artificial Intelligence Makes Both AUTHs More Important
Now consider what happens when autonomous AI agents become part of this equation.
An AI agent may have a valid digital identity.
It may authenticate successfully.
It may be operating within an enterprise environment using legitimate credentials.
But none of those facts automatically establishes that every action it attempts is appropriate.
Suppose an AI agent has permission to retrieve customer information to answer service inquiries.
Does that mean it should be permitted to export the entire customer database?
Suppose an agent can prepare a financial transaction.
Should it also be authorized to approve and execute that transaction without appropriate controls?
Suppose an agent is granted access to multiple enterprise applications.
What happens when its instructions are manipulated, its credentials are compromised, or it attempts actions beyond its intended responsibilities?
These are not simply authentication problems.
They are authorization, governance, and continuous trust problems.
And AI introduces an additional challenge: scale.
A human attacker may require hours to retrieve and process large volumes of information.
An automated system can potentially execute enormous numbers of actions in a fraction of that time.
If its authority is excessive, automation can magnify the consequences of misplaced trust.
This is why the future of identity security must extend beyond a single successful login.
I believe organizations increasingly need to evaluate five interconnected elements:
- Identity. Who or what is attempting to act?
- Intent. What is being requested, and for what purpose?
- Authority. Does this identity have permission to perform that specific action?
- Verification. Can the relevant identity and, where appropriate, the specific approval be independently established?
- Continuous Trust. Does the activity remain consistent with the permissions, purpose, and risk boundaries established for the interaction?
This is not an argument for making every digital interaction more complicated.
It is an argument for making security more intelligent.
The appropriate level of verification and authorization should reflect the sensitivity and consequences of the action.
A routine, low-risk request should not require the same safeguards as transferring millions of dollars or exporting sensitive patient records.
But neither should the latter be permitted simply because someone authenticated successfully earlier in the day.
Trust must be appropriate to the action, not merely inherited from the login.
Stronger Authentication Is Essential. But It Is Not the Entire Answer.
At Identité, our work with passwordless authentication, verifiable identity, and patented Full Duplex Authentication® reflects our commitment to strengthening identity verification and mutual authentication while reducing unnecessary friction.
We believe establishing identity with confidence is foundational to digital trust.
But it would be a mistake to suggest that even the strongest authentication technology can independently solve every security problem.
Authentication does not, by itself, enforce least-privilege access.
It does not automatically determine whether an authenticated user should be permitted to export sensitive information.
It does not independently establish whether an AI agent has authority to initiate a particular transaction.
And it does not replace behavioral monitoring, data-access controls, or effective governance.
Those capabilities require complementary systems and policies working together.
That distinction matters.
Because the objective should never be to make exaggerated claims about what one technology can accomplish.
The objective is to build security architectures in which the necessary protections reinforce one another.
Authentication establishes identity. Authorization establishes boundaries. Continuous evaluation helps determine whether trust should persist.
When these capabilities work together, organizations are better positioned to protect both their systems and the people who depend upon them.
The Human Cost of Getting It Wrong
When cybersecurity professionals discuss breaches, we naturally gravitate toward technical details.
Compromised credentials.
Access permissions.
Data exfiltration.
Identity management.
Incident response.
But consider the human experience behind those terms.
A university student learns that personal information entrusted to an educational institution may have been exposed.
A retiree receives a suspicious telephone call from someone who knows their address and national identification number.
A bank customer begins questioning whether an apparently legitimate communication is genuine.
A family worries about whether someone might attempt to misuse their personal information.
Denmark’s data-protection authority published advice for people concerned about possible misuse of their information after the CPR incident.
Exposure does not establish that every affected person suffered identity theft.
Concern about misuse is itself a reason for institutions to provide clear, practical support.
The consequences of a breach aren’t confined to servers, databases, or financial statements.
They follow people into their everyday lives.
An unexpected telephone call becomes suspicious.
A routine financial transaction becomes unsettling.
An ordinary request for information creates uncertainty.
The cost of a breach isn’t measured only by the information taken. It’s also measured by the confidence people lose.
And rebuilding that confidence is often considerably harder than resetting a password.
The Future of Digital Trust Requires Both
The ChoicePoint scandal showed us what happens when an organization fails to adequately verify who deserves access to sensitive information.
The Danish incidents show why account access, application vulnerabilities and the limits on data use need to be examined together.
The MGM Resorts incident reminds us that a major security event can have serious operational consequences, even when its full technical chain is not publicly established.
And autonomous AI agents are introducing a new generation of questions about identity, authority, and accountability.
These incidents are not identical.
Their causes, technologies, and circumstances differ.
But together they reinforce a lesson the cybersecurity industry can no longer afford to overlook.
Authentication is essential. Authorization is equally essential.
And neither should be treated as a one-time decision that eliminates the need for further evaluation.
The future of digital trust will depend on our ability to verify identities, enforce appropriate authority, evaluate consequential actions, and continuously recognize when trust should be limited or withdrawn.
All without placing unnecessary obstacles in the path of legitimate users.
Because people don’t want more security procedures.
They want confidence.
They want to know their information is protected, their transactions are legitimate, and the institutions they depend upon are worthy of their trust.
That is the human outcome our technology should serve.
And it brings us back to a lesson from King Arthur’s kingdom that has never been more relevant:
Authentication Opens the Gate. Authorization Protects the Kingdom.
We need both.
Because One AUTH Is Not Enough.
And when we forget that distinction, we don’t merely risk another security incident.
We risk the confidence of the very people our systems were designed to protect.
Verifiable Identity is the cornerstone of Digital Trust. Authorization ensures that trust is exercised within appropriate boundaries.
Technology should quietly serve humanity.
Continue the evaluation
Explore PasswordFree® customer access, NoPass™ workforce access and approval of sensitive actions. Select an actual workflow and establish which system owns enrollment, authority, recovery and execution.